Vendor risk for AI: when your model is someone else's API
AI کے لیے وینڈر رسک: جب آپ کا ماڈل کسی اور کا API ہو
20 min read
Three ways to see it
Vendor risk for AI has four dimensions. Data exposure: what flows to the vendor and where it is processed and stored. Model stability: what changes when the vendor updates the model. Concentration risk: are too many critical functions tied to one provider. Exit risk: can you switch within an acceptable window if the relationship ends. SBP technology risk guidance from 2024 and the PDPA 2023 both touch these.
Practical due diligence list. Ask for the data processing addendum and the location of processing. Confirm whether prompts and outputs are used for training the vendor's models, and how to opt out. Ask for the vendor's SOC 2 Type II, ISO 27001, and any AI-specific assurance such as ISO 42001. Get the model card or system card. Verify uptime targets, region failover, and incident notification windows in hours.
Model drift and silent change. A vendor can update the underlying model without telling you on the same date your contract started. Your prompts that worked last week may behave differently. Set up regression tests on a fixed evaluation set, run them weekly, and alert when scores drop by more than your tolerance. Pin model versions in the API call where the vendor supports it. Keep your prompts under version control with a changelog.
Quick check
Quick check: what makes modern AI different from a rule-based program?
The why-tree
Pakistani sensitivity. CNIC numbers, biometric data, and certain account details get extra protection under PDPA 2023 and SBP rules. Sending these to a foreign endpoint without a written legal basis and the right safeguards is a serious risk. Often the answer is to mask, tokenize, or summarize before the call leaves your environment. A redaction layer between your app and the vendor API protects you without slowing the experience much.
Try this with Claude
Board-level questions to ask before signing. One: which clauses in the master agreement satisfy PDPA 2023 and SBP outsourcing guidance. Two: which Pakistani regulator does the vendor recognize as having jurisdiction in a dispute. Three: what is the maximum financial liability for a confidentiality breach. Four: how is termination assistance defined and priced. Five: who at the vendor is the named point of contact for a regulator-led inquiry, and how fast do they respond.